.env.example

# Copy to `.env` and fill in.

LOG_LEVEL=debug

# Which environment every process runs as. Read by all of them — serve, the queue worker, the
# scheduler, and the one-shot commands — so they cannot disagree. Unset defaults to development.
#
# Deployments set `production`. That is not cosmetic: `configure` picks the default database name
# from it (`dev` vs `vapor_database`), so a deployment leaving it unset can put `serve` and its
# workers on *different databases* unless DATABASE_NAME is also pinned. It also keeps the
# development-only ICICLE seed migration from registering in production.
#
# Do not pass `--env` on a command line instead: that flag outranks this variable, so setting it
# on one process is how a stack ends up with processes disagreeing about their own environment.
VAPOR_ENV=development

# DATABASE_HOST is intentionally unset: configure.swift falls back to localhost for native
# runs, and the container recipes inject the database container's current network address.
DATABASE_PORT=5432
DATABASE_NAME=vapor_database
DATABASE_USERNAME=vapor_username
DATABASE_PASSWORD=vapor_password

# Queue storage (Valkey locally, any Redis-protocol server in a deployment). REDIS_HOST is
# unset for the same reason as DATABASE_HOST. Leave the password empty against the local
# server, which runs without auth; deployments set the cache's generated password.
REDIS_PORT=6379
REDIS_PASSWORD=

# Secret provider
SECRET_PROVIDER=tapis

# Tapis Vault
#
# The `/v3` suffix is required, verified against the live service: `/v3/tenants/icicleai` answers
# 200, `/tenants/icicleai` answers 404. Every Tapis URL is built off TAPIS_BASE_URL, so omitting
# it fails the tenant key fetch and the process exits at boot.
#
# TAPIS_BASE_URL and TAPIS_TENANT MUST NAME THE SAME TENANT — each tenant has its own host, so
# these two lines always move together:
#
#   production   TAPIS_TENANT=icicleai   TAPIS_BASE_URL=https://icicleai.tapis.io/v3
#   staging      TAPIS_TENANT=icicleai   TAPIS_BASE_URL=https://icicleai.staging.tapis.io/v3
#
# Use staging for local development. It is a completely separate vault, so `service-token
# init-key` and the vault tests never touch production credentials, and no dev/prod secret naming
# scheme is needed to keep them apart.
#
# Mixing host and tenant is quiet and expensive: the tenant record still resolves, so boot
# succeeds, but TapisAuthenticator compares each caller's `tapis/tenant_id` against TAPIS_TENANT
# and refuses every admin with a bare 403 while the service otherwise looks healthy. The boot log
# prints both values together so a mismatch is visible on startup.
#
# TAPIS_USER scopes the vault path (/security/vault/secret/user/<TAPIS_USER>/...), so a wrong
# value fails as "secret not found" rather than as an authentication error.
TAPIS_BASE_URL=https://icicleai.staging.tapis.io/v3
TAPIS_TOKEN=
TAPIS_USER=
TAPIS_TENANT=icicleai

# The one username that is always an admin, whatever the `admins` table says. Break-glass: an
# accidental deletion of the last row can never lock the deployment owner out. Everyone else is
# granted through the dashboard. Boot fails on an empty value.
#
# Must be a real `tapis/username` in TAPIS_TENANT above. A placeholder boots perfectly well and
# then matches nobody, so every write returns 403 with nothing in the log to explain it.
ROOT_ADMIN_USERNAME=

# Browser origins permitted to call this API. Comma-separated. Unset installs no CORS middleware
# at all, which is correct for a same-origin deployment; set it when another ICICLE site needs to
# read these metrics from a browser.
CORS_ORIGINS=

# Origins permitted to embed the dashboard in an iframe. Comma-separated, scheme required, no
# trailing path — `https://tapisui.example.org`, not `https://tapisui.example.org/`. Unset denies
# framing entirely, which is right for a standalone deployment. Set it to embed in TapisUI.
# Emitted as CSP `frame-ancestors`; `X-Frame-Options` is dropped once this is set, because that
# header has no allowlist form and could then only be wrong.
FRAME_ANCESTORS=

# Request ceilings, per minute. The first is per client IP across /api; the second is per webhook
# token on the metrics route. Counters live in the Valkey above, so limits hold across pods.
RATE_LIMIT_PER_MINUTE=300
WEBHOOK_RATE_LIMIT_PER_MINUTE=60

# Vault secret holding the webhook token signing keyset. Create it once with
# `swift run Insights service-token init-key`. Rotate with `service-token rotate-key`, which is
# additive — previously issued tokens keep working until they expire.
TOKEN_SIGNING_SECRET=insights-token-signing-key

# Slack incoming webhook for collection failures that have exhausted their retries. Leave empty
# to disable alerting entirely; failures are then reported to the log alone, which is the right
# setting for local work.
SLACK_WEBHOOK_URL=

# Optional second webhook. Unset, everything lands in SLACK_WEBHOOK_URL tagged by severity; set,
# it takes the ⚠️ failures (a deleted repository, a malformed response) so the channel carrying
# 🔴 credential failures stays quiet enough to act on.
SLACK_WEBHOOK_URL_WARNINGS=